4e57cfeec782e7e9dd90163dc3490285d8948e75db9eb95f7208f36897d737fc

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-09-2024 18:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

LIBROS/Sistemas de Informacion Gerencial-James-A-O-Brien ET AL.pdf
Size

7.1MB
MD5

1077f8691563d3f9e203a6e8262a1501
SHA1

7e658b6cf9013eb7b380ef2880e3bcea57737f51
SHA256

360b04617f43d0b9bc05913f438137d234ff6dc0f98a030d76b02a9bd9bba59d
SHA512

82138ff02ed4cdd3db1b81f2485a995dce25769d8151108822656dbf6a2ca34dfce159615ed84b0a1a4d3f623c9481e9c8e299a45387cd4f681b342d7ec90379
SSDEEP

98304:62K4kaMVZFJD8js8n7wGmSZhVJnVc3q73mzerl008tX4kj5/cXiWCj+9rdCb0HSe:/nMVZFd8aShVJny6SX4wlWCp8Nca

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2196	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2196	AcroRd32.exe
2196	AcroRd32.exe
2196	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\LIBROS\Sistemas de Informacion Gerencial-James-A-O-Brien ET AL.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4c9e6d0db9e68ae78855bcbde1423414

SHA1
43810c741c6d63660a9dac7caefd1a3ca6ee4f82

SHA256
02255f9482085183b3072a5201fc49750ef81c5fd1c0987ec77712ec032db451

SHA512
964740f13db9905003b390c3c3750aeafe41ba8f2a01226f013887206d7d97e779ef151ac430c3b25a87fa08d5a5104de01e15cc2e1af663687d1ea170ed5795

Download Submit